Calendario de trabajo

State laws often provide heightened protection for information related to individuals’ genetic makeup (genetics-related information). These protections are primarily focused on ensuring that individuals’ genetic profiles are not used against them in obtaining and retaining health

35 _{Figure includes Colorado, where state confidentiality requirements do not apply to covered entities.} 36 _{See, e.g., D.C. Code Ann. § 7-131(b)(1)(A) (2008); Del. Code Ann. tit. 16 § 1201(9) (2008)}

(defining “release”); 3(a)(3)-(4) (2008); Mass. Laws ch. 111, § 70F (2008); N.M. Stat. § 24-2B- 6(B),(C) (2008).

insurance. Almost all states have laws that specifically limit the ability of health insurers to use genetics-related information for underwriting.37 _{In contrast, a minority of the states}

(18) have laws specifically addressing genetics-related information that are broad enough to encompass health care providers (see Table A-4). In short, most of the state restrictions on sharing genetics-related information are imposed on health insurers as opposed to health providers.

3.4.1 Scope of Laws

State laws governing genetics-related information can generally be classified as solely pertaining to genetic testing and testing-related information or more broadly applying to genetic information. Laws in 10 states appear to fall within the first category and address the disclosure of genetic testing and information derived from genetic testing (see

Table A-4). New Hampshire, for example, limits the disclosure of genetic testing results or the fact that a person has undergone genetic testing [N.H. Rev. Stat. Ann. § 141-H:2(III) (2008)]. Genetics-related information laws in other states are somewhat broader and, in addition to genetic test-related information, also expressly protect other information such as family health history [Tex. Occ. Code 58.001 (2007)] or information about inherited

characteristics [N.J. Stat. Ann. 10:5-47(a),(b)(2008)]. Determining the scope of a state’s law requires a close analysis of the definition of terms. For example, upon a cursory reading Oregon’s law may appear to fall within the states that afford a broader range of protection because its law governs the disclosure of “genetic information.” However, the term “genetic information” is defined narrowly as being “information about an individual or the individual’s blood relatives obtained from a genetic test” [Or. Rev. Stat. § 192.531 (2008)].

For the most part, state genetics-related information laws apply to “any person,” or “any entity,” categories that include any health care provider in possession of the information. Alaska law, for example, provides that “a person” may not disclose the results of a DNA analysis unless the person has first obtained the informed and written consent of the person tested [Alaska Sta. 18.013.010 (2008)]. Genetics-related information laws in a few states, such as Massachusetts and Oregon, apply to specific categories of health care providers [Mass. Gen. Laws ch. 111, § 70G (2008); Or. Rev. Stat. §§ 192.519, 192.529 (2008)]. 3.4.2 Permission Requirements

In light of this framework, genetics-related information laws apply fairly uniformly to

hospitals, doctors of medicine, and pharmacists.38,39 _{Genetics-related information laws in 14}

37 _{Many of these laws were promulgated in response to limits on the use of genetic health information} by group health insurers contained in the portability provisions of HIPAA. The Genetic Information Non-Discrimination Act of 2008, Public Law no. 110-233, which prohibits discrimination by health insurers based on genetic information on a wider basis, supersedes less stringent state laws. 38 _{Pharmacists who engage in medication counseling may have genetics-related information in their}

states generally require the permission of the test subject for disclosure of genetic test or general genetic information even for treatment (see Tables A-5a, A-5b, and A-5c). Three of these states (Alaska, New Mexico, and New York) make an exception and permit disclosure without patient permission for emergency treatment. Laws in two states, Colorado40 _and

Oregon, expressly permit the disclosure of genetic information without patient permission to another provider for treatment [Colo. Rev. Stat. Ann. § 10-3-104.7 (2008); Or. Rev. Stat. § § 192.529; 192.539 (2008)]. Arizona permits disclosure of genetic testing-related

information for treatment, but limits such disclosure to providers assuming care from or consulting with the provider who had access to the patient’s genetic records [Ariz. Rev. Stat. Ann. § 12-2802 (2008)].

As noted, most states do not have laws that specifically govern the disclosure of genetics- related information that is maintained by health care providers. In these states, disclosure laws that generally apply to general health information, such as “health information,” “medical information,” or “medical records” (referred to in this report as general clinical information) are often broad enough to encompass genetics-related information. Many of these general clinical information laws permit the disclosure of health information for treatment without the patient’s permission (see Tables A-5a, A-5b, and A-5c).41

For example, it appears that general clinical information laws in 13 states would allow hospitals to disclose genetics-related information for treatment without the patient’s permission (see Table A-5a). An additional 17 states do not appear to have statutory or regulatory provisions specifically addressing the disclosure of either general clinical or genetics-related information by hospitals (see Table A-5a). In these states, the HIPAA Privacy Rule provides the standard for disclosure for treatment. In total, it appears that at least 32 states permit hospitals to disclose genetics-related information to other providers for treatment purposes without patient permission.42 _{A similar pattern is true for doctors of}

medicine and pharmacists (see Tables A-5b and A-5c).

39 _{Because clinical laboratories are subject to different disclosure standards under federal law they are} discussed separately.

40 _{Colorado’s statute applies only to nonprofit hospitals. See Colo. Rev. Stat. 10-3-1104.7(2)(a)} (2008) (defining “entities”).

41 _{Note that the entries in Tables A-5a-c that do not have a “G” summarize the state’s general clinical} health information law that applies to the entity in the absence of a genetics-specific law.

42 _{Figure includes states with laws that expressly permit disclosure of genetics-related information for} treatment, as well as those in which the general health information confidentiality law is applicable and either permits disclosure of health information for treatment or expressly or implicitly